Block User Account < 2.0.1 - Subscriber+ Account Block Bypass via Application Passwords

Description

The plugin does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.